How to get group information in case of AD , LDAP authentication?

In the previous post we have seen how to set up LDAP authentication in OBIEE .
If you have not read that I would advice you to read the article
here

In this post will go through limitations of Microsoft AD implementation for SSO.

LDAP Limitations with Microsoft AD

We can not use import ,import all or synchronize users from OBIEE admin in case of  AD.And we can not even get the user’s group defined in the AD.

As in case of groups it returns an array of chars and OBIEE does not understand it as a group name.( it requires group names separatedby ; )

So in we can not implement the security at User level we have to set the security at group level only.

let say we have user devang in LDAP.  and it belongs to a group called PowerUser.

Step 1 Create a database table and make entries

let say  our database table which has user and group called:  USER_SECURITY_GROUPS.

It has enty as user , group = devang,PowerUser

Step 2 Create a init block to get the user group information from database table

Lets called the initialization block as initGroup and create it as show below.

initiGroup creation

Note : in execution precedence make sure that initLDAP gets executed first. So that users gets authenticated and then get the group name from database table.

set 3 Create group in OBIEE repository

Create a group called PowerUser in OBIEE repository

Manage– > Security  –> Groups and create a new group

LDAP Group in Admin

set the permission for the group as required.

Step 4 Create a same catalog group in OBIEE answers.

Go to Setting — > Administration — > Manage Presentation Catalog Groups and Users

Group in Answers

Create a new catalog group

How to Implement Single Sign On (SSO) in OBIEE with Microsoft Active Directory ?

OBIEE LDAP authentication using microsoft Active Directory.

Before starting this, I would prefer that you read my article on session variable and initialized block here

SSO can be implemented using Lightweight Directory Access Protocol (LDAP) in OBIEE.

Most popular LDAP implementation for OBIEE is either OID (Oracle internet Directory) or Microsoft Active Directory (AD). And no wonder why LDAP authentication is supported more on OID and not AD (yeah Oracle v/s Microsoft). This does not mean we can not achieve SSO using LDAP for AD. Yes we can. But with little different implementation style and some limitations. (Oracle documentation talks about all OID and nothing at all for AD)

So Here I am going to discuss on how to implement LDAP authentication for AD to achieve SSO.

Below are the implementation step:

Setting up LDAP Server , Initialization Block and Session Variables

Step 1: Create LDAP Connection.

Open OBIEE Administration.

Go to Manage — > Security

Manage Security.

Select LDAP Servers : on the right side right click and select New LDAP Server

Security Manager

LDAP Connection

LDAP Connection Advance

Step 2: Create  initialization block and session variable

Go to Manage — > Variables

Click Session — > Initialization Block right click on the pan select New Initialization Block

Session Variable Initialization Block

Give the name to the Initialization Block e.g initLDAP

As a part of configuring Initialization Block you need to provide

Click on Edit Data Source

Data Source Type : select LDAP then click on Browse and select appropriate LDAP server connection

Data Source

Click on Edit Data Target

Session Variable

Click on New and you will see the screen like below

User Session Variable

Click ok you will and warning message as below. Just ignore it, as it warns that you are using USER session variable and it has special meaning

User Warning

User LDAP Variable

Here we have just create only one session variable which takes information from LDAP. We can create many such variable like groups( has limitation AD which i am going to discuss in detail) , display name etc etc whatever is available on LDAP.

LDAP admin can help with the name of  variable referred in LDAP

Click on Edit Execution Precedence

If you are using multiple Initialization block then this will be use ful in deciding which block should execute first. As we have just once init block we will not do anything here.

Click on Test

Enter LDAP  UserId and password, in sAMAccountName it should show the user Id which indicates the LDAP connection and hence authentication with LDAP works.

TEST LDAP connection

In the next post I will discuss on how to get group information, limitation of LDAP AD implementaion with OBIEE.

Oracle  Siebel nquire Software

History of what is now called as Oracle Business Intelligence Enterprise Edition (OBIEE)

Oracle bought Siebel Analytics in 2005 for close to $6 billion. And that is once of the reason some to script file in OBIEE installations has sbl as prefix .

Here is the example.

Go to <Home>\OracleBI\server\Scripts\Common and you will the screen as below.

sbl Prefix

And we go more deeper into the history Siebel bought nQuire Software was specialized in Internet-based business analytics capabilities.

Thomas Siebel, ex chairman and CEO of Siebel Systems bought nQuire Software in late 2001.

That is the reason some of the file in OBIEE installation still as NQ as prefix. like log files , config file ( NQSConfig.ini) etc

NQ Prefix

One will definitely come across requirement where he/she needs to merge two repository.

There will happens when we need to merger two entirely different repository or when we want to move incremental changes to production.

OBIEE does support 2 online repository ( However you can have 2 repository online but by doing so one will lose the oracle’s product support). In this case merging two repositories into one and making it online is the solution!

Let me discuss that aspect first.

We will two standard repositories  paint.rpd with UsageTracking.rpd so that we can get the usage information in paint repository.

Steps  1  Background

You can mergr two repository in one ,when one is online. However I would not suggest you to do that.

Make sure while merging you are working offline in Administrator tool.

Merging originally designed to work with three repositories. As we have just two repositories we will create a dummy repository.

Go to Administration — > File — > New and create a new repository call dummy.rpd

Creating Dummy.rpd

( Save this to this default location <Home>\ OracleBI\server\Repository however this is not necessary)

Now close this repository with doing anything. Just save when prompted.

Step 2 Open the paint.rpd in offline

Open pain.rpd

paint.rpd

Step 3 Merger paint.rpd with dummy.rpd

Go to File — > Merge and select dummy.rpd

open dummy.rpd for Merge

You will see the screen as below:

Merge Screen

step 4 Click select for the Modified Repository and select UsageTracking.rpd

Selecct usage tracking for merging

In decision you can either select Modified or Current. As we are merging 2 different repository it ok. select merge. You will see an error message called : Delete Failed. Just ignore that message.

And you will see both the repository merged as below.

Merged Repository Paint and UsageTracking

In Cache Management Part 1 I have written about over view of the cache in OBIEE system. Today I continuing from there…

A : Configuring cache parameters in NQSConfig.ini

Go to [ CACHE ] section of the config file

1 ENABLE  should be YES for cache to work.

2 DATA_STORAGE_PATHS : Need path where cache file to be stored and max allowed size

3 MAX_ROWS_PER_CACHE_ENTRY: Max row to be in any cache file. And hence his parameter helps to avoid run away query results being cache

4 MAX_CACHE_ENTRY_SIZE : Max size of each cache file

5 MAX_CACHE_ENTRIES: Max cache file in the directory specified.

Note:  When limit specified in MAX_CACHE_ENTRIES reached server will delete the Least Recently Used (i.e file which has not been used since long) to accommodate the new entry

6 POPULATE_AGGREGATE_ROLLUP_HITS: default is NO. It will store the agg result even if that request is being served from cache

7 MAX_SUBEXPR_SEARCH_DEPTH: it seaches the express till  the level specified for the cache hit.
B : Controlling cache at physical layer in Administrator tool

Physical Property Of table :Cache

Please note the cacheable checkbox. By default all the physical tables are cacheable.

rest two options determines cache is valid till what time ?

Cache never expires will put the entry in cache permanently unless its cleaned by paramer 5 above

Cache persistence time This will determine validity time of cache

C :Using Cache manager

Open repository in online mode

Go to Manage–>Cache  You will see the screen as below. OBIEE administrator can control the cache from here as well.

Cache Manager Cache Tab

Cache Manager Physical tabl

Cache Operations

You can see all the cache entries as shown in the screen above. You can purge the cache from here , see the sql being generated , Copy -save sql , and see the info which basically shows you the config parameters for the cache.

So this will be helpful in purging the cache entries manually.

I would suggest you to explore all the options.
D: Automatically purging cache entries

Cache entry will automatically gets purged when MAX_CACHE_ENTRIES limit reaches or when on physical layer it reaches that time.

Another Way to Automatically purge cache is to use even pulling table.

Event pulling table reads the data ( or status of the ETL ) and based on that it purges the cache. The problem with this is: it is not purely even base. i.e we can do like purge the cache and seed cache when ETL is done. However it can read the pulling table at specific interval and decides its action.

It a separate post in itself. I will address this in my future post.

E: Seeding cache

In normal English Seeding cache means running report automatically or manually (mostly in non business hours) before user actually needs it.

So when users needs that data it reads from the cache and hence performance is really amazing.

1 you can run report maually to generate cache( this is not possible for non business hours)

2 setting and iBot to run the report at specific time so that it generates cache.

Please refer the screen print below for better understanding.

Seeding Cache

You may create an iBot for the report for which you want to seed the cache. In Destinaton tab select Oracle BI Server Cache check box to seed the cache as shown above.

OBIEE Cache Management

Back Ground

Business Intelligence system user usually queries a larger Data Warehouse or Data Marts.
And when ask few import things they are looking for, and performance ALWAYS comes!!!. Cache helps to make a BIG win when it comes to performance.

So Cache helps us in
1) Achieving better performance for query by not going to Database server and satisfying request from cache file on OBIEE server itself.( There are some criteria for cache hit to occur)
2) It saves network resources by not make round trip.

But with performance comes some cost.
1) Human Resources to mange
2) Physical Resource (data storage etc)
3) Keeping cache up to date. (If users gets data quickly but its not fresh/updated then it does not make sense either).

Below is the process flow or Architecture of OBIEE cache

Cache System Archicture

Steps to Configure the Cache

Step1: Change NQSConfig.ini file

Go to \ OracleBI\server\Config\ NQSConfig.INI

In NQSConfig.ini go to cache section you will see something as below screen shot

Cache Sesction of Config file

All the parameters are basically self explanatory like path of file , size , number of rows etc etc

Oracle suggests having cache file on high speed storage.

Step 2: Managing the cache.

We can do cache management with various techniques

A : Configuring cache parameters shown in the file above
B : Controlling cache at physical layer in Administrator tool
C :Using Cache manager
D: Automatically purging cache entries
E: Seeding cache and event pooling table.

I will cover all above five techniques in my next post.

How to enable usage tracking in OBIEE ?
How to perfrom usage audit in OBIEE ?
How to set you Direct Insertion to Collect Information for Usage Tracking ?

Introduction

Oracle BI server supports collection of usage statistics which can use in a variety of ways such as who is running what and when ? database optimization, aggregation strategies, figuring out most used reports, billing departments as per their usage etc etc.

Goal

We want to achieve a reporting for usage in OBIEE. One such sample report is attached. Lots of analysis similar to this can be achieved using the Usage Tacking.

Usage Tracking Report

How it works?

When we enable usage tracking, statistics for every query are inserted into a database table or are written to a usage tracking log file. If you use direct insertion, the Oracle BI Server directly inserts the usage tracking data into a relational database table.

There are two ways to achieve Administration of usage tracking.

• Setting Up Direct Insertion to Collect Information for Usage Tracking
• Setting Up a Log File to Collect Information for Usage Tracking

Oracle Recommendation: Use direct insertion to write statistics to a database table.And I am going to discuss that method here.

Steps to Set Up Direct Insertion to Collect Information for Usage Tracking:

Set 1 : Create a necessary tables to collect usage tracking information.

A. Click here to download SAACCT.Oracle.sql or

Go to \\OracleBI\server\Schema and run the script  SAACCT.Oracle.sql to create table S_NQ_ACCT. This table will hold all the usage tracking information.

B. Go to \\OracleBI\server\Sample\usagetracking

This folder has necessary time series table creation script  and build in repository for usage tracking.

Create a tables using scripts:

Oracle_create_nQ_Clock.sql and Oracle_create_nQ_Calendar.sql

Load data in above tale using  Oracle_nQ_Clock.sql and Oracle_nQ_Calendar.sql script.

Step 2 Import  S_NQ_ACCT into the repository.

Please note: in order for Usage tacking to work properly , one must have to include this table in physical layer.

Step 3  Creating a business and presentation layer.

We will use a repository provided at C:\OracleBI\server\Sample\usagetracking\UsageTracking.rpd So that we want have to create a repositoy from ground zero.

Click  UsageTracking.rpd to down load the usage tracking repository.

Step 4 Change configuration file.

This is most important step in setting up usage tracking.

Go to \\OracleBI\server\Config and open NQSConfig.INI.

We have to make the change in [ USAGE_TRACKING ] portion of the config file.

Change DIRECT_INSERT                  = YES;
Along with this we have change the connection properties as well.
–PHYSICAL_TABLE_NAME
–CONNECTION_POOL

Change below parameter for better insertion performance and insertion control

–BUFFER_SIZE
–BUFFER_TIME_LIMIT_SECONDS
–NUM_INSERT_THREADS
–MAX_INSERTS_PER_TRANSACTION

Please refer below screen shot for more detail.
Note : Any typo will hold server from starting.

NQSConfig DIRECT_INSERT

Step 5 Check results to see every things is working.

Copy repository UsageTracking.rpd to OracleBI\server\Repository\
make Star = UsageTracking.rpd, DEFAULT; in NQSconfig file.

Restart BI server. If server fails to start check possible typo in NQSConfig

Check the Answers to see various analysis available for Usage Tracking.

Once should be able to see the reporting as shown below.

Usage Tracking Report

What is Initialization Block and session variable in OBIEE +?

How to use row level security in OBIEE ?

If you a familiar with the web development you should be aware of the concept call constructor. Constructor is automatically called when object is initiated. And object initiated means; object is assigned to the memory. Destructor is does the exactly opposite work by cleaning/freeing the memory used by object.

And object here is Session.
So long story short. You can use initialized the session variable under Initialization Block in OBIEE +.

Session variables are like a global variable. They are available across the repository.

Types of Session Variable

System: Session variable

System session variables are session variables that the Oracle BI Server and Oracle BI Presentation Services use for specific purposes. System session variables have reserved names that cannot be used for other kinds of variables (such as static or dynamic repository variables and no system session variables).
Examples of the System session variable

USER Holds the value the user enters as his or her logon name.
EMAIL Contains the user’s default email address for use with Answers

Non System: Session variable

The procedure for defining non system session variables is the same as for system session variables.

A common use for non system session variables is setting user filters. For example, you could define a non system variable called   USERNAME in UsageTracking.rpd repository. So that each user can just see their usage not every one else’s Usage.

Below are the steps on how to achieve this.

Step 1: Create an initialize block called setUser

Initialization Block

Variable Manager

Step 2: Create session variable called: LOGIN

Variable Creation

Step 3: Set the filter in Presentation Layer for the Column.

Variable Filter

Step 4: Run the report in Answer to verify that filter and all is working.

Answer's Report

Wow…. We just got the data related to customer’s only

Step 5: Check the sessions

Now when report is running check in the OBIEE Administrator
go to Manage – -> Sessions

Session Manager

Great we can check the Session Variable LOGIN and its Value is Administrator which is user who is currently logged in.
It gives lots of other information about the session like
Session id which is unique for each Session
Variable contains the name of the session etc

Step 6: Check logs

Make sure that for Administrator or the user for which you want to see the logs , proper log level has been set. Logging level 5 is good enough to see the query being sent to database.

Logging level 0 Means no Logging
Logging level 7 Max logging

Please note: On production system Logging is overhead unless and until it is absolutely required.

Check Log Level

Go to \server\Log\ NQQuery.log

You will see the screen shot as attached below

Log file

Below is the list of OBIEE components (programs) and services responsible to run them. Below article is based on Windsow environment.

1) Oracle Business Intelligence Server (Oracle BI Server)
2) Oracle Business Intelligence Presentation Services (Oracle BI Presentation Server)
3) Oracle Business Intelligence Javahost (Oracle BI Java Host)
4) Oracle Business Intelligence Scheduler (Oracle BI Scheduler)
5) Oracle Business Intelligence Cluster Controller ( Oracle BI Cluster Controller)

If you followed the default installation then first 3 services will have start up type as Automatic and 4th and 5th will have start up type as Manual.

Please note that in Oder to enable Scheduler and Cluster Controller additional configuration is required. That will be discussed in separate post.

Below Screen print shows those services.

OBIEE Services

If changes have been made to Oracle BI serve’s configurations, repository files, Web Catalog for Answers , other configurations etc then above services needs restart.

Please not that order in which services are being restarted is very important. And it is as below.

1) Oracle Business Intelligence Server (Oracle BI Server)
2) Oracle Business Intelligence Presentation Services (Oracle BI Presentation Server)
3) Oracle Business Intelligence Javahost (Oracle BI Java Host)
4) Oracle Business Intelligence Scheduler (Oracle BI Scheduler)
5) Oracle Business Intelligence Cluster Controller ( Oracle BI Cluster Controller)

Important this is not all services needs restart each time you make any of the changes describe. It mainly depends on the changes or rather type of change you are making.

Requirement : Often time its really a pain to create users in bulk.So below script will be helpful to create users with default password.

Step 1: Create the script as shown below.
This script basically creates a declaration syntex for OBIEE.

Run the SQL Command like to Generate the File Called : userImport.udml (or you may use excel or something else )

SELECT
‘DECLARE USER “‘|| Sales_person ||’” AS “‘||Sales_person ||’” UPGRADE ID 1121 FULL NAME {’||Sales_Person_Name||’} PASSWORD ”’Welcome”’ PRIVILEGES ( READ);’ FROM tbl_sales_person
Modify the script according to the usage.

save the output of the above sql command to a file called
userImport.udml

Step 2: Run the command to load the users
Once above file is ready locate the exe file called nqudmlexec.exe

(History : nqudmlexec.exe – check the name, it starts with nq. Siebel had acquired nQuire Software in 2001. Still lots of logs, exes still have prefix nq)

Run the below command to
C:\OracleBI\server\Bin>nqudmlexec -U -P
I userImport.udml -B Security.rpd -O Security1.rpd

Importing OBIEE Users to repository